If a user's account is targetted for a brute force attack then it should get locked or alert in a manner that is not specific to an IP address.
This obviously needs more discussion on the solution and might be better left to a separate, lock-specific module that TFA would just integrate with.
Closed: outdated
2.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Drupal 7 end-of-life triage:
Drupal 7 reached end of life on January 5th.
The 7.x branches of TFA do not have any additional planned releases.
The requests in this issue do not appear to exist in the 8.x-1.x and newer branches.